Overview

Red Teaming & Active Directory Exploitation Course GuideRed Teaming and Active Directory exploitation are among the most in-demand cybersecurity skills in modern enterprise environments. This course is designed to help you crack Red Teaming and Active Directory interview questions with confidence through a targeted MCQ-based format that mimics real-world red team scenarios.You will gain deep, hands-on knowledge of Active Directory internals, enumeration, attack paths, privilege escalation techniques, and persistence strategies through carefully crafted multiple-choice questions. This course is not just about definitions-it's about understanding how attackers think, how they move laterally, and how to break modern enterprise defenses.I. Active Directory Pentesting FundamentalsDifficulty Level: Easy to Medium1. Core AD Concepts for PentestingMCQ Count: 10-15Topics:FSMO Roles (PDC Emulator, RID Master, Infrastructure Master, Schema Master, Domain Naming Master)Global CatalogSchemaTrusts (Transitive, Non-Transitive, One-Way, Two-Way)SPNsSubtopics:How FSMO roles are relevant for privilege escalation and persistence (e.g., Compromising PDC Emulator for password resets)Impact of schema modifications from an attacker's perspectiveLeveraging trust relationships for lateral movement between domains/forestsUnderstanding SPNs for Kerberoasting and constrained/unconstrained delegation attacks2. Essential AD Authentication Protocols (Offensive Lens)MCQ Count: 15-20Topics:Kerberos (TGT, TGS, Service Ticket)NTLM (v1, v2)LM/NTLM HashingSubtopics:Deep dive into Kerberos ticket flow and how it's manipulated for PtT, Golden Ticket, Silver TicketNTLM weaknesses (responder attacks, NTLM relay)Understanding the different hash formats and their cracking implicationsThe role of the KRBTGT account in Golden Tickets3. AD Tools for Offensive Operations (Foundational)MCQ Count: 10-15Topics:Mimikatz (core modules: sekurlsa logonpasswords, kerberos golden, lsadump)BloodHound (data ingestion, basic graph analysis)Impacket suite (psexec, smbclient, getnpusers, gettgt)Subtopics:Installation and basic usage of these toolsInterpreting Mimikatz output for credential extractionGenerating and understanding basic BloodHound attack pathsUsing Impacket scripts for fundamental lateral movement and enumerationII. Active Directory Reconnaissance & Enumeration (Offensive)Difficulty Level: Medium1. Internal Network Footprinting for ADMCQ Count: 10-15Topics:DNS enumeration (zone transfers, dnsrecon, dnspython)Network scanning for AD services (LDAP, Kerberos, SMB)Identifying domain controllersSubtopics:Leveraging DNS for subdomain discovery and identifying internal domain structuresPort scanning specific to AD services (e.g., 389, 636, 88, 445, 3389)Techniques to reliably identify all domain controllers in a network segment2. Advanced User and Group EnumerationMCQ Count: 15-20Topics:LDAP queries (using ldapsearch, ldp exe, PowerShell's Get-AD* cmdlets)ADreconPowerview ps1 (user/group functions)enum4linuxSubtopics:Crafting specific LDAP filters to find privileged users, accounts with specific attributes (e.g., dontReqPreauth), or users in specific OUsEfficiently enumerating group memberships, including nested groupsIdentifying users with common or weak password patterns through enumeration3. Service Principal Name (SPN) Enumeration & AnalysisMCQ Count: 10-15Topics:setspn -QGet-ADComputer -Properties servicePrincipalNameGet-ADUser -Properties servicePrincipalNamePowerView's Get-NetServicePrincipalNameSubtopics:Understanding how SPNs are registered and their formatIdentifying SPNs for Kerberoasting targets (accounts with UserPrincipalNames or ServicePrincipalNames)Differentiating between legitimate and potentially vulnerable SPN registrations4. Active Directory Object Access Control List (ACL) EnumerationMCQ Count: 15-20Topics:BloodHound (ACL analysis)PowerView's Get-DomainACLGet-ADACLACLs for AD objects (DACLs, SACLs)Subtopics:Identifying dangerous ACLs that grant excessive permissions (e.g., GenericAll, GenericWrite, WriteDACL, WriteOwner, AllExtendedRights)Understanding the common misconfigurations that lead to exploitable ACLsMapping out potential attack paths using ACLs with BloodHound5. GPO and AD Domain/Forest Trust EnumerationMCQ Count: 10-15Topics:Get-GPOGet-ADTrustnltest /domain_trustsSubtopics:Identifying GPOs that might contain sensitive information (e.g., passwords in SYSVOL, restricted groups)Analyzing GPOs for security settings that can be leveraged (e.g., insecure delegated permissions on GPOs)Mapping trust relationships and understanding their directionality and transitivity for cross-domain lateral movementIII. Active Directory Attack Techniques (Deep Dive)Difficulty Level: Hard1. Credential Theft & ExtractionMCQ Count: 25-30Topics:Mimikatz (LSASS dump, sekurlsa logonpasswords, lsa cache, dcsync)Ntds dit extraction (Volume Shadow Copy, esentutl exe)KerberoastingAS-REPRoastingResponder (LLMNR/NBT-NS poisoning, HTTP/SMB relay)Subtopics:Detailed step-by-step process of performing LSASS dumps and extracting credentialsUnderstanding the mechanics of dcsync and its requirementsThe process of identifying Kerberoasting targets, extracting TGS-REPs, and offline crackingAutomating AS-REPRoasting and its limitationsSetting up and using Responder for various credential relay and capture scenarios2. Lateral Movement TechniquesMCQ Count: 25-30Topics:Pass-the-Hash (PtH)Pass-the-Ticket (PtT)Overpass-the-HashPsExec (and its variants/alternatives)WMI (wmiexec, Invoke-WMIExec)SMB (smbexec)WinRM (winrmexec, Invoke-WinRM)DCOMRemote Desktop Protocol (RDP)Subtopics:Detailed execution flow and differences between PtH, PtT, and Overpass-the-HashUnderstanding the various methods of remote command execution in AD (e.g., psexec services, WMI event subscriptions, WinRM sessions)Chaining lateral movement techniques for deeper accessEvading detection during lateral movement3. Privilege Escalation in ADMCQ Count: 30-35Topics:Unconstrained Delegation abuseConstrained Delegation (S4U2self, S4U2proxy) abuseGolden TicketSilver TicketAdminSDHolder/AdminCountGPO abuse (Restricted Groups, Startup Scripts, GPP CPasswords)ACL-based privilege escalation (e.g., GenericAll, WriteDACL, WriteOwner)Printer Spooler (PrintNightmare, PetitPotam)DCsync via delegated permissionsSubtopics:Identifying and exploiting vulnerable delegation settingsCrafting and utilizing Golden Tickets (KRBTGT hash) for full domain compromiseGenerating and using Silver Tickets for specific service accessFinding and leveraging misconfigured GPOs for privilege escalationDetailed walkthroughs of ACL abuse paths using BloodHoundUnderstanding and exploiting PrintNightmare and PetitPotam for NTLM relay or privilege escalation4. Persistence MechanismsMCQ Count: 20-25Topics:Skeleton KeyGolden Ticket renewalSilver Ticket re-generationAdminSDHolder/SDPROP modificationService Accounts (modifying servicePrincipalName, userAccountControl)Scheduled TasksGPO modification (e.g., UserLogonScript, ComputerStartupScript)DCSync via WriteDACL on domain objectDomain Controller compromise backdoorsSubtopics:Methods for establishing long-term, stealthy access within the AD environmentUnderstanding the detection challenges for each persistence methodTechniques for creating and maintaining covert backdoorsAbusing legitimate AD features for persistence5. Data Exfiltration & ImpactMCQ Count: 10-15Topics:DCSync (full ntds dit replica)lsass exe dumpTargeted data exfiltration (specific user hashes, certificates, sensitive files)Subtopics:Methods to extract the entire ntds dit database remotely or locallyTechniques for obtaining credentials from lsass exe dumpsIdentifying and exfiltrating critical information (e.g., password policies, security principals, sensitive user data)IV. Red Teaming Operations in AD EnvironmentDifficulty Level: Medium to Hard1. C2 Infrastructure for AD PentestingMCQ Count: 10-15Topics:Domain FrontingHTTP/S C2DNS C2SMB C2Payload stagingRedirectorsSubtopics:Designing resilient C2 infrastructure for AD engagementsConfiguring various C2 channels for stealth and evasionTechniques for staging payloads effectively in an AD environment2. Evasion & Stealth in ADMCQ Count: 20-25Topics:Living Off The Land (LotL) binaries (certutil exe, bitsadmin exe, powershell exe, runas exe)Process injectionReflective DLL loadingUnhookingAMSI bypassesAppLocker bypassesDefender for Endpoint/AV evasionCustom malware developmentSubtopics:Using built-in Windows tools to perform malicious actions without introducing new executablesTechniques to evade endpoint detection and response (EDR) solutionsDeveloping custom tools and payloads for specific AD attack scenariosUnderstanding common AMSI/AppLocker bypasses3. OpSec Considerations for AD PentestingMCQ Count: 10-15Topics:Operational Security planningQuiet hoursAnti-forensics (timestamp modification, log cleaning)Avoiding noisy techniquesSubtopics:Planning operations to minimize detection riskTechniques for cleaning up traces after an attack (e.g., event logs, command history)Balancing aggressive exploitation with stealth4. Scoping & Rules of Engagement (RoE) for AD PentestingMCQ Count: 5-10Topics:Defining clear objectives (e.g., Domain Admin, specific data exfiltration)Identifying critical assetsHandling sensitive dataCommunication protocolsRed/blue teaming interactionSubtopics:Importance of well-defined RoE for AD engagementsManaging the scope to avoid unintended impactCommunication strategies with the client and blue team5. Reporting for AD Pentesting EngagementsMCQ Count: 5-10Topics:Attack narrativeDetailed steps to reproduceImpact analysisSpecific remediation recommendations for AD vulnerabilitiesPost-engagement debriefingSubtopics:Crafting clear and actionable reports for AD security weaknessesProviding practical remediation steps for AD misconfigurations and vulnerabilitiesEffectively communicating technical findings to both technical and non-technical stakeholdersCourse SummaryThis comprehensive course covers all critical aspects of Red Teaming and Active Directory exploitation, from fundamental concepts to advanced attack techniques. The MCQ-based format ensures practical knowledge that can be immediately applied in real-world scenarios.Total Estimated MCQ Count: 240-340 questions across all modulesThe course emphasizes hands-on understanding of tools, techniques, and methodologies used by professional red teams to assess and exploit Active Directory environments effectively.

Skills

Reviews